Malicious PDF — malware analysis report

Static analysis result for SHA-256 24f5e47c9f8b7954…

MALICIOUS

PDF

68.8 KB Created: 2021-03-17 23:21:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97b980ab5ee04fe9731b9c3a16a81a83 SHA-1: d1ffd71bc5b6e5e98d298011734195c3f0512ff8 SHA-256: 24f5e47c9f8b795432176e278f38146e5d983292f60e987850ccfd8367770041
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file exhibits characteristics of a phishing lure, employing numerous embedded links, some of which are repeatedly presented invisibly, to direct users to external sites. The primary URL suggests a download for a 'market helper apk', indicating a potential attempt to trick users into downloading malware disguised as a legitimate application. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=download+market+helper+apk+apkhere.com
    • http://pedron.fun/bedanejavuvuso4el93.pdf
    • https://cdn.sqhk.co/wufevinek/hheRijH/how_to_iron_a_dress_shirt.pdf
    • https://cdn.sqhk.co/ximirujusuxo/gdjdWTP/jesejewaju.pdf
    • https://cdn.sqhk.co/pusobatosip/hjejjgd/46080015658.pdf
    • https://mejotowud.weebly.com/uploads/1/3/0/9/130969644/22fcf7d337.pdf
    • https://jimedugevebuz.weebly.com/uploads/1/3/4/4/134437071/55273c00dbcca2d.pdf
    • https://xupusunozad.weebly.com/uploads/1/3/1/0/131070799/b04856f.pdf
    • http://emmetrix.net/cirque_du_freak_book_1_download38h3y.pdf
    • https://bunekapizo.weebly.com/uploads/1/3/0/9/130969144/b5d97224b36780c.pdf
    • https://dedotomonifagax.weebly.com/uploads/1/3/1/6/131606429/64a6279c.pdf
    • https://xakalawuvobovu.weebly.com/uploads/1/3/1/0/131071286/8229912.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://14da0a27-f261-4d4b-8668-3a369f5c966d.filesusr.com/ugd/46429b_14d0b0c0c48a4f6a81097a77bcc935b4.pdf?index=true
    • https://1ceef7f3-d523-4f80-a0a4-3aed54d3d17a.filesusr.com/ugd/48841a_ffbe2ac27b094c7f8e63aa5a9ed7e4e8.pdf?index=true
    • https://s3.amazonaws.com/luramamelolem/78853251099.pdf
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_dc2eebd3f48e49f691e1dba062392d25.pdf?index=true
    • https://11627308-8c8f-4f08-99ed-0ad85160907d.filesusr.com/ugd/682d1c_49f68cfbeb474db282793d5bf27d7eb2.pdf?index=true
    • https://s3.amazonaws.com/gagagakigibapo/demaniwevawobiz.pdf
    • https://s3.amazonaws.com/zamemigojat/24691814650.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d155.bin
f1b0eb2ed86aee0ffd60185bb9196f45ee746784db86791487eddfc9bff9d89a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD155 5320 bytes
font_01_sfnt_off0000e362.bin
19a11f0ffc5ebb9bcc2b1c18fc84188889d47bb71e9e374f0ae9269c4b61d60e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE362 10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.